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Summary 

A hazard assessment was conducted on the GRC managed payloads in support of a NASA 
Headquarters Code Q request to examine STS-107 payloads and determine if they were credible 
contributors to the Columbia accident. This assessment utilized each payload’s Final Flight Safety Data 
Package for hazard identification. An applicability assessment was performed and most of the hazards 
were eliminated because they dealt with payload operations or crew interactions. A Fault Tree was 
developed for all the hazards deemed applicable and the safety verification documentation was reviewed 
for these applicable hazards. At the completion of this hazard assessment it was concluded that none of 
the GRC managed payloads were credible contributors to the Columbia accident. 


Introduction 

This payload hazard assessment was conducted in support of a NASA Headquarters Code Q request 
to examine STS- 1 07 payloads and determine if they were credible contributors to the Columbia accident. 
This Payload Hazard Assessment reviewed the hazards and hazard controls associated with the payloads 
managed by the NASA Glenn Research Center on the STS- 1 07 mission. It was not intended to be a 
review of other payloads or hazards associated with the STS-107 Shuttle vehicle. 


Description of GRC Payloads 

Payloads managed by the NASA Glenn Research Center that flew on STS-107 were: 

1 . The Orbiter Acceleration Research Experiment (OARE) mounted in the bottom of the Shuttle 
Payload Bay. 

2. The Critical Viscosity of Xenon-2 (CVX-2) experiment mounted in two canisters on a cross-bay 
Hitchhiker (HH) Multipurpose Equipment Support Structure (MPESS). This was a part of the 
Fast Reaction Experiment Enabling Science Technology, Application and Research 
(FREESTAR) mission. 

3. The Space Acceleration Measurement System Free Flyer (SAMS-FF) mounted in the 
SPACEHAB Research Double Module (RDM) 

4. The Combustion Module 2 (CM-2) mounted in the SPACEHAB RDM. It should be noted that 
CM-2 was used to support three separate experiments; Laminar Soot Processes (LSP), Structures 
of Flame Balls at Low Lewis numbers (SOFBALL) and the Water Mist Fire Suppression 
Experiment. 
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Assessment Methodology 


The initial effort was the identification of the credible hazards for each GRC payload. Each payload’s 
final Flight Safety Data Package (SDP) was reviewed for hazard identification. These Flight SDPs were 
developed in accordance with the Shuttle Payload Phase Safety Review Process defined in NSTS/ISS 
13830C, “Payload Safety Review and Data Submittal Requirements.” The Shuttle Payload Phase Safety 
Review Process requires that a detailed Flazard Analysis to be performed on payloads that includes the 
consideration of all hardware, software, human actions, and their interaction. In the initial planning 
meetings for this assessment, it was pointed out that all of the credible hazards identified in these Flight 
SDPs are comprehensively reviewed and evaluated because of the nature of the Shuttle Payload Phased 
Safety Review Process. In addition, all these payloads, with the exception of the Water Mist Fire 
Suppression Experiment that was part of CM-2, had gone through the Shuttle Payload Phased Safety 
Review Process at least twice. It should be noted that the organization of the final CM-2 Flight SDP 
included its three supported experiments therefore CM-2 and its three supported experiments were 
assessed as a single payload. 

The second step in the assessment was to determine if any of the credible hazards associated to the 
GRC managed payloads could be possible contributors to the Columbia accident. A Hazard Applicability 
Assessment was performed on all hazards identified in each payload’s final Flight SDP (see appendix A). 
This assessment evaluated the nature of each hazard as well as its possible impact for the operational 
mode and environment of Columbia during the time leading up to the accident. A very conservative 
approach was used for this Hazard Applicability Assessment. If it was at all possible that a fault or failure 
could be propagated across the payload-vehicle interface and cause damage of some kind to the orbiter, it 
was considered “Applicable.” In addition, a fault tree was developed with the Top-Fevel Event defined as 
“Catastrophic Failure propagates across payload interfaces” (see appendix B). 

In the third step of this payload assessment, the applicable basic events or hazard causes that were 
found (and indicated on the fault trees) were reviewed to determine if appropriate hazard controls had 
been specified and implemented by GRC prior to the flight of STS-107. The appropriate hazard controls 
were verified by reviewing the associated safety verification documentation to show that the controls 
were specified, correct, and were in fact implemented. Technical questions on the physics of the hazards 
or the implementation of hazard controls were discussed with the payload project managers and 
engineers. 


Payload Hazard Assessment Results 

A total of 63 hazards were identified in the final Flight SDPs of which only 13 were considered 
applicable. The Hazard Applicability Assessment that was performed has been included as appendix A. 
This Hazard Applicability Assessment provides the rationale used to determine the applicability of each 
hazard. The following paragraph addresses the major factors that impacted hazard applicability. 

OARE was the only GRC payload operating at the time leading up to the accident. This factor of not 
being in operation eliminated many of the hazards from the other payloads. Other hazards were 
eliminated because they were only applicable to crew interaction operations and none of the GRC 
payloads had crew interaction during the time leading up to the accident. The environment of Columbia 
during the time leading up to the accident also eliminated other hazards. Columbia was at an altitude of 
approximately 200,000 feet where the pressure would still be very low, a few pounds per square inch 
absolute (psia) at most. The delta pressure loads on the two GRC payloads, OARE and CVX-2 in 
Columbia’s payload bay would be minimal in this environment therefore the hazards associated with 
these delta pressure loads were considered as non-applicable. 
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The safety verification documentation for the applicable hazards was reviewed to insure that the 
specific hazard controls were implemented. No discrepancies were found in the safety verification 
documentation. 


Conclusions 

At the completion of this hazard assessment as outlined above, it was concluded that none of the GRC 
managed payloads were credible contributors to the Columbia accident. 
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Appendix A 

GRC STS-107 Payloads Hazard Applicability Assessment Results 


Combustion Module-2 (CM-2) 

Hazards 

1. Exposure of Crew to Non-ionizing Radiation — not applicable. Crew interface hazard that is not a 
concern in the de-orbit configuration (see Hazard Report CM-1 : 1). 

2. Exposure of Crew to Broken Brittle Materials — not applicable. Crew interface hazard that is not a 
concern in the de-orbit configuration (see Hazard Report CM-1 :2). 

3. Rupture of Pressure System Hardware — applicable (see Hazard Report CM-1 :3). 

Hazard causes 

a. Improper design 

b. Selection of materials susceptible to Stress Corrosion Cracking 

c. Fluid/hardware material incompatibility 

d. Improper design of pressure relief devices 

e. Damage due to improper handling during ground assembly 

4. Release of Combustion by-products — not applicable. Crew interface hazard (toxicity) that is not a 
concern in the de-orbit configuration (see Hazard Report CM-1 :5). 

5. Release of Experimental Fluids — applicable (see Hazard Report CM-1 :6). Hazard causes related to 
reduction in oxygen or toxicity are not applicable for the de-orbit configuration. 

Hazard causes 

a. Leakage of fluids from gas bottles exceeds lower flammability limit 

b. Improper filling of pre-mixed gas and fuel bottles 

6. Detonation of Flammable Materials (Gases) — not applicable. Hazard deals with the release of 
excessive quantities of flammable gases into the CM-2 Combustion Chamber and ignited. CM-2 was 
not powered for the de-orbit configuration so ignition was not possible (see Hazard Report CM-1 :7). 

7. Electrical Shock — not applicable. Crew interface hazard that is not a concern in the de-orbit 
configuration (see Hazard Report CM-1:8). 

8. Inadvertent Release of V-Band Clamp — not applicable. Hazard involves operations with the CM-2 
Combustion Chamber pressurized. This was not the case for the de-orbit configuration (see Hazard 
Report CM-1: 10). 

9. Excessive Touch Temperature — not applicable. Crew interface hazard that is not a concern in the 
de-orbit configuration (see Hazard Report CM-1 : 1 1). 

10. Potential Ignition Sources without Smoke Detection — not applicable. Hazard involves operations 
with CM-2 powered. This was not the case for the de-orbit configuration (see Hazard Report CM- 
1:12). 
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11. Electrical Connector Mating/Demating — not applicable. Hazard involves mating/demating or 
electrical connections by crew. This type of operation was not being performed during the de-orbit 
configuration (see Hazard Report CM-1:13). 

12. Leakage/Rupture of Water Cooling Loop — applicable (see Hazard Report CM-1:14). 

Hazard causes 

a. Improper design of the pressurized lines, fittings, and components 

b. Leakage resulting from loose or misassembled components 

13. Rupture of Lithium Battery — applicable (see Hazard Report CM-1:15). Over-charging Hazard cause 
not applicable because CM-2 was not powered externally during de-orbit configuration. 

Hazard cause 

a. Excessively rapid discharge due to short circuit 

14. Release of LiOH — not applicable. Crew interface hazard (toxicity) that is not a concern in the 
de-orbit configuration (see Hazard Report CM-1:16). 

15. Overheating of Electrical Wire — not applicable. CM-2 was not powered in de-orbit configuration 
(see Hazard Report G-2). 

16. Excessive EMI — not applicable. CM-2 was not powered in de-orbit configuration (see Hazard 
Report G-3). 

17. Exposure of Crew to Shaip Comers — not applicable. Crew interface hazard that is not a concern in 
the de-orbit configuration (see Hazard Report G-4). 

18. Materials Offgassing — not applicable. Crew interface hazard that is not a concern in the de-orbit 
configuration (see Hazard Report G-5). 

19. Use of Flammable Materials — not applicable. CM-2 was not powered in de-orbit configuration 
(see Hazard Report G-6). 

20. Structural Failure of Experiment Hardware — applicable (see Hazard Report G-7). 

Hazard causes 

a. Inadequate Structural Strength including pressure loading 

b. Use of materials susceptible to stress corrosion cracking 

c. Use of defective materials including pre-existing flaws or counterfeit fasteners 

d. Improper manufacture or assembly 

21. Rapid Safing — not applicable. Rapid safing operations were not required to configure CM-2 
hardware for de-orbit configuration (see Hazard Report IH-1). 
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22. Structural Failure of Sealed or Vented Containers — applicable as 2nd Order Hazard. This would 
require a de-pressurization of the SpaceHab module during Shuttle de-orbit (see Hazard Report 
STD-CM-2 hazard (2)). 

Hazard causes 

a. Inadequate structural strength for de-pressurization loads 

b. Inadequate vent sizing or blocked vents 

23. Rotating Equipment Structural Failure — not applicable. CM-2 was not powered for the de-orbit 
configuration and therefore failure of the CM-2 Rotating Equipment is not credible. 

24. Detonation of Flammable Materials (Mist Gases) — not applicable. Hazard deals with the release of 
excessive quantities of flammable gases into the CM-2 Combustion Chamber and their ignition. 
CM-2 was not powered for the de-orbit configuration so ignition was not possible (see Hazard Report 
CM 1:7a). 

25. Rupture of Gas Chromatograph Lithium Battery — applicable (see Hazard Report CM-l:15a). Over- 
charging Hazard cause not applicable because CM-2 was not powered externally during de-orbit 
configuration. 

Hazard causes 

a. Improper battery circuit design 

b. Battery failure/damage 

c. Excessive rapid discharge due to short circuit 

26. Rupture of Sealed LSP Soot Sampler Box (Explodes due to Over Pressurization) — not applicable. 
Soot Sampler Box in stowage for de-orbit configuration (see Hazard Report CM-2: 18). 

27. Overpressurization of Mist Flame Tube — not applicable. Hazard deals with operations in CM-2 
Combustion Chamber. Mist Flame Tube in stowage for de-orbit configuration (see Hazard Report 
CM-2: 19). 

28. Structural Failure of Mist Hardware — not applicable. Mist hardware in stowage for de-orbit 
configuration (see Hazard Report STD-MIST Hazard (1)). 

29. Structural Failure of Mist Sealed or Vented Containers — applicable as 2nd Order Hazard. This 
would require a de-pressurization of the SpaceHab module during Shuttle de-orbit (see Hazard Report 
STD-MIST Hazard (2)). 

Hazard causes 

a. Inadequate structural strength for de-pressurization loads 

b. Inadequate vent sizing or blocked vents 

30. Mist Sharp Edges — not applicable. Crew interface hazard that is not a concern in the de-orbit 
configuration (see Hazard Report STD-MIST Hazard (3)). 

31. Mist Shatterable Materials Release — not applicable. Crew interface hazard that is not a concern in the 
de-orbit configuration (see Hazard Report STD-MIST Hazard (4)). 
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32. Mist Flammable Materials — not applicable. CM-2 was not powered in de-orbit configuration (see 
Hazard Report STD-MIST Hazard (5)). 

33. Mist Materials Offgassing — not applicable. Crew interface hazard that is not a concern in the de-orbit 
configuration (see Hazard Report STD-MIST Hazard (6)). 

34. Mist Nonionizing Radiation — not applicable. CM-2 was not powered in de-orbit configuration (see 
Hazard Report STD-MIST Hazard (7)). 

35. Mist Touch Temperature — not applicable. Crew interface hazard that is not a concern in the de-orbit 
configuration (see Hazard Report STD-MIST Hazard (9)). 

36. Mist Electrical Power Distribution — not applicable. CM-2 was not powered in de-orbit configuration 
(see Hazard Report STD-MIST Hazard (10)). 

37. Mist Rotating Equipment Failure — not applicable. CM-2 was not powered in de-orbit configuration 
(see Hazard Report STD-MIST Hazard (12)). 

38. Mist Contingency Return and Rapid Safing — not applicable. Rapid safing operations were not 
required to configure CM-2 hardware for de-orbit configuration (see Hazard Report 
STD-MIST (14)). 

39. Rupture of Gas Supply System — applicable. Hazard causes related to on-orbit operations are not 
applicable for de-orbit configuration (see Hazard Report Mist-02). 

Hazard causes 

a. Improper design 

b. Use of materials susceptible to stress corrosion cracking 

c. Fluid/hardware material incompatibility 

d. Improper manufacture/assembly or ground handling 

e. Propagation of crack-like defects 

40. Propulsive Leak from Mist Gas Supply Bottle — not applicable. Hazard deals with crew operations. 
Supply Bottles secured in stowage for de-orbit configuration (see Hazard Report Mist-03). 


NASA/TM— 2004-213050 



Critical Viscosity of Xenon-2 (CVX-2) 


Hazards 

1. Ignition of Flammable Payload Bay Atmosphere — applicable as 2nd Order Hazard. Requires 
leakage of combustible fluid and oxidizer into payload bay (see Hazard Report CVX-F-1). 

Hazard causes 

a. Electrical ignition due to CVX main circuit or battery powered heater circuit 

b. Hot surface on canister due to failure of descent heater thermostatic switch 

c. Improper grounding of MLI blankets or other conductive material susceptible to ESD 

2. Battery Rupture/Release of Corrosive Electrolyte — applicable (see Hazard Report CVX-F-2). 

Hazard causes 

a. Battery short circuit/overcurrent 

b. Build-up or venting of flammable gases (hydrogen) causes over-pressurization of 
battery box or Hitchhiker canister 

c. Electrolyte leakage from individual cells 

3. Damage to Shuttle Electrical Systems — not applicable. CVX-2 was electrically isolated from Shuttle 
circuitry by Hitchhiker during the de-orbit configuration. Note that CVX-2 may still have been 
powered by its internal batteries (applies to Hazard Report HH-F-1). 

4. Electromagnetic Interference with Space Shuttle Operations — applicable. Requires that CVX-2 has 
not expended all battery power for de-orbit (see Hazard Report HH-F-2). 

Hazard cause 

a. Improper design, associated shielding, or grounding 

5. Uncontrolled fire hazard to the STS or other payloads — applicable as 2nd Order Hazard. Hazard 
requires the leakage of one of the Hitchhiker canisters containing CVX-2 that were inerted with 
nitrogen prior to launch. It also requires that CVX-2 has not expended all battery power at the time of 
de-orbit and it is assumed there is an ignition source internal to CVX-2 (see Hazard Report HH-F-4). 

Hazard cause 

a. Improper materials selection. 

6. Failure of Experiment Support Structure within Sealed Canister — applicable (see Hazard Report 
HH-F-6). 


Hazard causes 

a. Inadequate structural design 

b. Improper materials selection including usage of materials susceptible to stress 
corrosion cracking 

c. Defects or flaws in the experiment structure propagate to failure 

d. Defective manufacturing and/or assembly including fasteners 
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Orbital Acceleration Research Experiment (OARE) 


Hazards 

1. Fire/Explosion including Ignition of Flammable Atmospheres in Payload Bay — applicable as 2nd 
Order Hazard. Hazard requires leakage of combustible fluid and oxidizer into payload bay (see 
Hazard Report OARE-OOl). 

Hazard causes 

a. Improper electrical design causes arcing/sparking 

b. Improper design results in excessive surface temperatures 

c. Improper grounding of conductive material susceptible to ESD 

2. Structural Failure — applicable (see Hazard Reports OARE-002 and SHELF-02). 

Hazard causes 

a. Inadequate structural strength for all induced loads 

b. Inadequate structural strength due to excessive loading by coupling with Shuttle 
natural frequencies 

c. Improper material selection and processing, including usage of stress corrosion 
sensitive materials 

d. Metal fatigue or propagation of inherent cracks/intemal flaws 

e. Use of counterfeit or substandard fasteners 

f. Fastener failure due to loosening 

g. Improper manufacture and/or assembly 

3. Non-Ionizing Radiation — applicable (see Hazard Report OARE-003). 

Hazard cause 

a. Improper electrical design, including associated shielding, or grounding 

4. Sharp Edges — not applicable. Crew interface hazard is not a concern in the de-orbit configuration 
(see Hazard Reports OARE-004 and SHELF-01). 

5. Ionizing Radiation — not applicable. The Ionizing source is too small to adversely affect Shuttle 
systems. 

6. Electrical Power Distribution — applicable (see Hazard Report OARE-006). 

Hazard causes 

a. Electrical faults in payload while connected to the Space Shuttle due to short-circuit 
or abrasion 

b. Improper sizing of wiring/fuses 

7. Structural Failure of Vented Containers — not applicable. Delta pressure loading not significant on 
OARE vented containers at the altitude of the STS-107 accident (see Hazard Report OARE-007). 
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Space Acceleration Measurement System-Free Flyer (SAMS-FF) 


Hazards 

1. Structural Failure — applicable (see Hazard Report SAMS-FF-02). 

Hazard causes 

a. Inadequate structural strength for all induced loads 

b. Inadequate structural strength due to excessive loading by coupling with Shuttle 
natural frequencies 

c. Improper material selection and processing, including usage of stress corrosion 
sensitive materials 

d. Metal fatigue or propagation of inherent cracks/internal flaws 

e. Use of counterfeit or substandard fasteners 

f. Fastener failure due to loosening 

g. Improper manufacture and/or assembly 

2. Structural Failure of Sealed or Vented Containers — applicable as 2nd Order Hazard. This would 
require a de-pressurization of the SpaceHab Module during Shuttle de-orbit. All SAMS-FF hardware 
is considered as vented containers (see Hazard Report STD-SAMS-FF-01 Hazard (2)). 

Hazard causes 

a. Inadequate structural strength for de-pressurization loads 

b. Inadequate vent sizing or blocked vents 

3. Sharp Edges — not applicable. Crew interface hazard that is not a concern in the de-orbit configuration 
(see Hazard Report STD-SAMS-FF-01 Hazard (3)). 

4. Shatterable Material Release — not applicable. Crew interface hazard that is not a concern in the 
de-orbit configuration (see Hazard Report STD-SAMS-FF-01 Hazard (4)). 

5. Flammable materials — not applicable. Payload un-powered in de-orbit configuration (see Hazard 
Report STD-S AMS-FF-0 1 Hazard (5)) . 

6. Materials offgassing — not applicable. Crew interface hazard that is not a concern in the de-orbit 
configuration (see Hazard Report STD-SAMS-FF-01 Hazard (6)). 

7. Non-ionizing Radiation-non-transmitters — not applicable. Payload un-powered in de-orbit 
configuration (see Hazard Report STD-SAMS-FF-01 Hazard (7)). 

8. Touch Temperature — not applicable. Crew interface hazard that is not a concern in the de-orbit 
configuration (see Hazard Report STD-SAMS-FF-01 Hazard (9)). 

9. Electrical Power Distribution — not applicable. Payload un-powered in de-orbit configuration 
(see Hazard Report STD-SAMS-FF-01 Hazard (10)). 

10. Rotating Equipment — not applicable. Payload un-powered in de-orbit configuration (see Hazard 
Report STD-SAMS-FF-01 Hazard (12)). 
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Appendix B 

Fault Trees for Catastrophic Hazards 
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Catastrophic failure propagates across CVX-2 interface. 
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Flammable gas mixture in payload bay. 
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CVX-2 provides an ignition source. 
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OARE Interface 
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Catastrophic failure propagates across OARE interface. 
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Damage to orbiter from ignition of CM-2 experiment gases. 



CM-1-14-1 CM- 1-14-2 

Containment failure of CM-2 water loop damages Spacelab hardware. 



CM-1-15-1 CM1-15-2 

Rupture of DPP RAM CFLi battery on CM-2. 


NAS A/TM— 2004-2 13050 


23 




in 


O 


r 1 ' 


6 


CO 


6 


(N 


o 


6 


2 

03 


£ 

■o 

!•— 

03 


(/) 

(D 

U) 

03 

E 

03 

-o 


o 

M— 

o 

2 

_3 

£ 

2 

3 

+-* 

O 

3 


CO 


NAS A/TM— 2004-2 1 3050 


24 


1 

Structural Failure 
of Sealed or 
Vented Containers 

CT- 

STD-CM-2-HAZ(2) 



HAZ-2-1-1 


HAZ-2-1-2 


HAZ-2-1-3 


Structural failure of sealed or vented containers. 


i 

Depressurization of 
SpaceHab Module 
during de-orbit 



STD-CM-2-HAZ(2)-2 


NAS A/TM— 2004-2 13050 


25 



1 5a-2- 1 15a-2-2 

Rupture of GC lithium battery. 
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Catastrophic failure propagates across SAMS-FF interface. 



Appendix C 
Glossary 

This glossary contains definitions for terms which are contained in this report. 

Catastrophic Failure: A catastrophic failure event whose effects could cause disabling or fatal personnel 
injury; or loss of the orbiter, ground facilities or STS equipment. 

Catastrophic Hazard: A hazard which can result in the potential for: disabling or fatal personnel injury; 
or loss of the orbiter, ground facilities or STS equipment (NSTS 1700. 7B, Safety Policy and 
Requirements for Payloads Using the Space Transportation System). 

Failure: The inability of a component, software, or human to perform a required function, or to perform a 
required function within specified limits within an operating environment, or for a specified duration. 

Failure Propagation: An event that occurs when failure of an item (hardware, software, crew member) 
results in damage to another item (conceivably another component, payload, or the carrier vehicle) such 
that maintenance is required (derived from SSP 30234, “Failure Modes and Effects Analysis and Critical 
Items List Requirements for Space Station”). 

Failure Tolerance: Basic safety requirement used to control most payload hazards. The payload must 
tolerate a minimum number of credible failures and/or operator errors determined by the hazard severity 
level. This applies to a loss of function or inadvertent occurrence of a function that could result in a 
hazardous event. 

Function: An action or process performed by a device, software, or human that results in the transfer of 
energy but may also include a transfer of information. Passive components of a system, such as structure, 
have a function which is load bearing capability. Welds, brazing, and epoxy have a function which is to 
provide adhesion of parts when subjected to forces. “Function” applies to the fuel gases and oxygen for 
experiments in that their function is to support combustion. 

Flazard Applicability Assessment: An assessment that evaluates the nature of each system hazard and 
its possible impact for the relevant operational modes and environment. 

Inhibit: A design feature that provides a physical interruption between an energy source and a function. 
Two inhibits are independent if no single credible failure, event, or environment can eliminate both 
inhibits. 

Payload: Equipment designed and developed for the purpose of performing research onboard a space 
vehicle. The payload is not considered to be part of the vehicle although it interacts with the vehicle. 

Payload Interface : The physical parts of a payload that connect to the vehicle and provide transfer of 
energy and information between the payload and the vehicle or provide containment of the payload that 
constitutes the boundary between the payload and the vehicle. 

Second Order Hazard : A hazard that would require other failures, faults, events, or conditions to occur 
in combination with it in order to provide a causal path to a catastrophic failure. 

System: All Hardware, Software, and Human Actions required for the safe and successful execution of 
necessary functions to achieve mission objectives. 
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